>We are receiving in our server tons of Spam emails with Subjects like this:
>M___crie as suas proprias estampas 391
>As you can see, it has at least two underscore characters ( __ ) and I
think this would be the only >way to scan them.
You should have posted a complete spam, or at least complete headers. There
probably are a lot more spam signs available in a typical spam.
The concern I have with the rule you want is that it is likely to hit on a
lot of ham messages as well as the spams you want to filter. Generally you
should look for 2 or 3 things at least in a mail to filter it. For
instance, there is a number at the end of that subject line. That is often
typical of spam. Is there always only one letter before the two
underscores? Is it always uppercase? Is it always 'M'? All of these would
be good things to know.
The specific rule you asked for would be written as
header SUB_UNDERSCORES Subject =~ /__/
score SUB_UNDERSCORES 0.1
But don't use it, or at least not with any significant score.
If I assume that the underscores always come in the middle of the first word
of the subject, and the subject always ends with a number, I get:
header US_SPAM Subject =~ /^\s*\w+__\w.{1,80}\s\d+\s*$/
score US_SPAM 2.0
describe US_SPAM Possible spam with a double underscore subject
That might be a useful rule to try if you don't have anything better to
filter on.
Remember to restart spamd (if you are using it) after changing the rules
file.
Loren
